ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
A restart may be required to begin seeing some ETW events with EDR and SEP 14.3 RU3
Article ID: 223251
Endpoint Detection and Response
Endpoint Security Complete
Beginning with SEP 14.3 RU3 where EDR is in use, a restart may be required to begin seeing some ETW events recorded from the device.
- Endpoint Detection and Response
- Endpoint Protection (SEP) 14.3 RU3
Below are the following scenarios where a restart will be required to begin seeing ETW events.
- If EDR is enabled and the SEP client is updated to 14.3 RU3.
- If SEP 14.3 RU3 is installed, then EDR is enabled.
If SEP 14.3 RU3 is installed and EDR is disabled, ETW events will still be generated until the system is restarted.